CVE-2026-50619

CriticalCVSS 9.3/10Last modified Oct 15, 2026

Description

A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data.

We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
QNAP Systems Inc.	Qsirch	>= 7.0.x, < 7.0.3.0

References

https://www.qnap.com/en/app-release-notes?keyword=Qsirch&app=Qsirch&product-line=nas

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-50624.9The PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin plugin for WordPress is vulnerable to CVE-2026-506228.8Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authe CVE-2026-506234.8An authentication bypass vulnerability exists in the OAuth2 TokenIntrospectionService in Apache CXF. Due to a missing 'throw' keyword in the CVE-2026-506279.1The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a J CVE-2026-506289.8A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from CVE-2026-506295.3The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing con CVE-2026-50637.2The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via POST parameter key CVE-2026-506306.5A CRLF injection vulnerability exists in the OAuth2 AuthorizationUtils class. When constructing the WWW-Authenticate response header, the 'r CVE-2026-506317.4A race condition in AbstractOAuthDataProvider allows concurrent requests using the same Refresh Token to bypass single-use semantics and gen CVE-2026-506328.1A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identi CVE-2026-506338.1A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacke CVE-2026-506346.5A vulnerability in Apache CXF's JwsJsonContainerRequestFilter can be exploited to cause CXF to process metadata that was not authenticated b